A cyber-storm watch went out last month, and almost nobody reported it

Source: Fortune ·

A cyber-storm watch went out last month, and almost nobody reported it

The breach always makes news. The patch never does.

From the source

Last month, the SANS Internet Storm Center raised its threat level for the first time since December 2021. By its own records, it had done so only 10 times since 2010. Finland took government websites offline, and the Dutch parliament’s site went dark. The National Security Agency and Britain’s National Cyber Security Centre urged organizations to take offline any system they could not fix at once. You may not have heard much about it. Students in my cybersecurity class did. I scrapped the plan for our next lecture to cover it. The main cause was PHP2Shell, a pair of vulnerabilities, or security flaws, in PHP, the programming language behind about 70% of the websites whose language is known. The vulnerabilities, which let an attacker take over a web server, had lurked in the language since at least 2012 until a researcher working with an OpenAI model found them. PHP’s maintainers released a patch on Oct. 21, but attacks were already under way. And a patch protects only the servers on…

BestAIBroker analysis

Read the original source